diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-08-11 20:17:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-08-11 20:39:20 +0200 |
| commit | d912e449b655797407a75527380c566955b71a8e (patch) | |
| tree | 392b432edecba4d8a714da69dc123900d43b5be9 /libavcodec/cavsdec.c | |
| parent | 961a1a81d88a05afabb895f8a9dd11e789a07d89 (diff) | |
| parent | c766eb1ce1edb3ad03472b78c21e42c543b04937 (diff) | |
| download | ffmpeg-d912e449b655797407a75527380c566955b71a8e.tar.gz | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
ac3enc: add macros for option names to make them more understandable.
ac3enc: fix 'channel_coupling' option to actually allow 'auto'.
cavs: fix some crashes with invalid bitstreams
ac3enc: clip coupling coordinates during calculation
Remove incorrect info in documentation of AVCodecContext.bits_per_raw_sample.
lavc: fix parentheses placement in avcodec_open2().
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/cavsdec.c')
| -rw-r--r-- | libavcodec/cavsdec.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index fcfe06e2ce..fedee8bf72 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -192,7 +192,8 @@ static inline int decode_residual_inter(AVSContext *h) { static int decode_mb_i(AVSContext *h, int cbp_code) { GetBitContext *gb = &h->s.gb; - int block, pred_mode_uv; + unsigned pred_mode_uv; + int block; uint8_t top[18]; uint8_t *left = NULL; uint8_t *d; @@ -448,6 +449,8 @@ static inline int check_for_slice(AVSContext *h) { if((show_bits_long(gb,24+align) & 0xFFFFFF) == 0x000001) { skip_bits_long(gb,24+align); h->stc = get_bits(gb,8); + if (h->stc >= h->mb_height) + return 0; decode_slice_header(h,gb); return 1; } @@ -662,7 +665,7 @@ static int cavs_decode_frame(AVCodecContext * avctx,void *data, int *data_size, buf_end = buf + buf_size; for(;;) { buf_ptr = ff_find_start_code(buf_ptr,buf_end, &stc); - if(stc & 0xFFFFFE00) + if((stc & 0xFFFFFE00) || buf_ptr == buf_end) return FFMAX(0, buf_ptr - buf - s->parse_context.last_index); input_size = (buf_end - buf_ptr)*8; switch(stc) { |